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APPARATUS FOR DETECTING AND PREVENTING 
SUBSCRIBER NUMBER TUMBLING IN A 
CELLULAR MOBILE TELEPHONE SYSTEM 

FIELD OF THE INVENTION 

5 This invention relates to cellular mobile 

telephone systems and, in particular, to apparatus 
that detects attempts by an unauthorized user to use 
bogus subscriber numbers, obtained by tumbling 
subscriber numbers, to originate unauthorized calls. 

10 PROBLEM 

It is a problem in the field of cellular mobile 
telephone systems to prevent call initiations by 
unauthorized users who attempt to fraudulently access 
the cellular mobile telephone system. There are 

15 numerous methods used to originate unauthorized calls 
in cellular mobile telephone systems and many of these 
methods are difficult to detect and prevent due to the 
mobile nature of the subscriber station set. One 
method of fraudulent access is the use of subscriber 

20 number tumbling to obtain unauthorized access to the 
cellular mobile telephone system. Subscriber number 
tumbling is accomplished by an unauthorized user 
programming the cellular telephone station set to 
tumble subscriber numbers in order to deceive the 

25 cellular mobile telephone system into providing call 
services to the unauthorized user. Existing cellular 
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mobile telephone systems can not distinguish between 
valid and fraudulent subscriber numbers in a service 
area remote from the subscriber's home switch due to 
the fact that the subscriber station sets are mobile 
5 and are only identified to the cellular telephone 
system by subscriber number and unit identification 
number- On existing cellular telephone systems, the 
roaming subscriber validation process is not initiated 
until the call is completed and all call detail 

10 records are complete, including call duration. The 
serving cellular telephone switch then requests that 
the subscriber's home switch validate the 
authorization of the roaming subscriber to receive the 
requested service. Service can be denied to a 

15 fraudulent tumbled telephone number only when the 
fraud is detected and the fraudulent unit identified. 
However, the tumbling process is successful since a 
new subscriber number is used for each call initiation 
by the unauthorized user. There presently exists no 

20 system that can provide this fraudulent unit detection 
and service theft prevention capability since call 
validation occurs after the call is completed and the 
tumbled number is not reused by the bogus subscriber 
unit . 
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SOLUTION 

The above described problems are solved and a 
technical advance achieved in the field by the 
apparatus for detecting and preventing subscriber 
5 number tumbling in a cellular mobile telephone system. 
This apparatus operates to verify the authorization of 
a subscriber number to be used for roaming by scanning 
a central database of valid subscriber numbers to 
positively verify the calling mobile subscriber unit. 

10 If this unit is not identified in this database the 
apparatus verifies the authorization of the calling 
mobile subscriber unit in the cellular mobile 
telephone system by routing a roamer verification 
request directly to the home switch of the subscriber. 

15 The failure of the home switch to positively validate 
the roaming subscriber is typically indicative of 
attempted fraudulent access to the cellular mobile 
telephone system. In response to the lack of a 
positive roamer validation, this apparatus identifies 

2 0 the roaming subscriber as a bogus subscriber unit. 

Once this bogus subscriber unit is identified, the 
call origination by the bogus subscriber unit is 
denied and further theft of service prevented. This 
apparatus can block tumbled subscriber number calls on 
25 a per call origination basis, regardless of the 
tumbling algorithms used. 

The detection of a bogus subscriber unit is 
accomplished by routing data relating to a roaming 
subscriber call origination to a central subscriber 

3 0 verification system that maintains records of all the 

subscribers presently active or authorized to 
originate and receive calls in the particular cellular 
mobile telephone service area. The call origination 
data is compared to the subscriber status data in the 
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user database to obtain positive verification of the 
mobile subscriber unit. Rather than simply relying on 
the data that is stored in the user database to 
identify authorized roaming subscriber numbers, in 
5 response to positively validate the roaming subscriber 
number, this apparatus transmits a query to the home 
switch of the roaming subscriber to request positive 
- -validation of the roaming subscriber. The completion 
of the call origination is delayed by the serving 

10 cellular switch until a positive roamer verification 
is received from the roaming subscriber's home switch. 
The central subscriber validation system maintains a 
database that identifies the correspondence between a 
roaming subscriber number and the home switch of that 

15 subscriber number- By providing a data connection to 
the home switch on each roaming subscriber call 
origination to validate the roaming subscriber's 
identity, calling party authorization can be 
determined on a per call basis. The call origination 

20 is not serviced until a positive verification is 
received from the home switch or database authorizing 
the roaming subscriber call origination. By verifying 
roaming subscriber number on a real-time, per call 
origination basis, this system thwarts all methods of 

25 subscriber number tumbling. 
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DETAILED DESCRIPTION OF THE DRAWING 

Figure 1 illustrates in block diagram form the 
architecture of a typical cellular mobile telephone 
system; 

Figures 2 and 3 illustrate in block diagram form 
architectural details of the apparatus of the present 
invention; 

... Figures. 4 . t- 6 illustrate .in flow diagram .form the 
operational steps taken by this apparatus to detect 
subscriber units that are tumbled subscriber numbers. 



WO 93/11646 



-6- 



PCT/US92/10198 



DETAILED DESCRIPTION 

Figure 1 illustrates a typical cellular mobile 
telephone system that includes a plurality of Mobile 
Telephone Switching Off ices (MTSO) 102, 103, each of 
5 which is connected via communication facilities 1121- > 
1124, 1131-1133 to a plurality of cell site 
transmitters 121-124, 131-133, Mobile subscriber 
units A, B within each cell site 106 , 107 -can initiate 
or receive telephone calls via radio frequency 

10 communication with transceiver apparatus 121-124, 131- 
133 located in their corresponding cell site 106, 107. 
A plurality of cell sites 106 are interconnected with 
a designated Mobile Telephone Switching Office 102 
which serves to interconnect the transceivers 121-124 

15 in the various cell sites 106 served by the Mobile 
Telephone Switching Office 102 with the Public 
Switched Telephone Network (PTSN) (not shown) to 
access other Mobile Telephone Switching Offices as 
well as conventional telephone apparatus. 

20 The range of a particular cellular service is 

determined by the geographic location of -the cell 
sites. In addition, cellular mobile telephone systems 
are not connected on a nationwide basis. Rather , the 
industry consists of many distinct geographical 

25 regions that service a specific "home" base of 
subscribers. For example, in Figure 1 the bold line 
C-C denotes a boundary between two cellular regions, 
with Mobile Telephone Switching Office 102 being 
located in a first of these regions and Mobile 

3 0 Telephone Switching Office 103 being located in a 
second juxtaposed region. When cellular subscribers 
leave their home geographical region they become 
"roamers". When a roaming subscriber places a h 
cellular telephone call, the foreign system that 
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provides service has no way of determining if this 
roamer is a valid subscriber or a bogus subscriber, 
since this information is located in the roamer 1 s home 
system. Obtaining the information from the home 
5 switch, and notifying the foreign system of the roamer 
status is the purpose of the roamer verification 
system, illustrated in Figure l. The cellular mobile 
: , .telephone . system/. ; generally includes apparatus to 
maintain data concerning each subscriber authorized to 
10 initiate and receive calls within the cellular mobile 
telephone network. These subscribers include 

subscribers for whom the local Mobile Telephone 
Switching Office 102 is their base switch and roamers 
who are subscribers from other service areas who have 
15 entered or are passing through this service area. The 
subscriber validation apparatus can be included in 
each of the Mobile Telephone Switching Offices- 102, 
103 and coordinated therebetween or may reside in a 
central clearinghouse location (roamer Verification 
20 System 101) to serve a plurality of the Mobile 
Telephone Switching Office 102, 103. For the purpose 
of this description, assume that a subscriber 
validation apparatus is located in roamer verification 
system 101 which is interconnected via data link or 
25 dial up communication facilities 104, 105 with the 
plurality of Mobile Telephone Switching Offices 102, 
103 illustrated in Figure 1 as well as others not 
shown thereon. The apparatus illustrated in Figure 1 , 
are well known in the cellular mobile telephone 
30 industry and represent the basic systems within which 
the apparatus of the present invention cooperatively 
operates . 

The cellular mobile telephone network operates 
much as a conventional land line telephone switching 
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network with the exception that the subscriber units 
A, B are mobile and must therefore include a method of 
uniquely identifying each mobile subscriber unit 
operational within each service area. Furthermore, 
5 these mobile subscriber units A, B are typically in 
motion during the call connection and the 
communication between the mobile subscriber unit A and 
trie cell- si-fee transmitters 121-124- must be dynamically 
configured in response to the movements of the 

10 particular mobile subscriber unit A. In order to 
uniquely identify a mobile subscriber unit as a 
billable entity, each mobile subscriber unit must be 
assigned a direct dial telephone number, referred to 
as the Mobile identification Number (MIN) , as well as 

15 an equipment identification number, referred to as the 
Electronic Serial Number (ESN) , to enable other 
subscribers to call this particular mobile subscriber 
unit and to enable the cell site transmitters to 

0 

uniquely identify this mobile subscriber unit A among 
20 the many that are operational in the service area. 

Fraudulent Call Activity - Tumbling 

It is obvious that the accurate recordation of 
call activity is dependent on. the ability of the 
cellular mobile telephone network to uniquely identify 

25 each mobile subscriber unit operating within the 
service area as a billable entity. This goal is 
easily thwarted by a user who programs their cellular 
mobile subscriber unit B with the identification 
assigned by the cellular mobile telephone network to 

30 either a valid mobile subscriber unit A operational 
within the service area or a totally fictitious mobile 
subscriber unit. Existing cellular telephone systems 
perform a roaming subscriber validity/ authorization 
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verification after the cellular call is completed. 
Therefore, the bogus mobile subscriber unit can 
originate and complete a cellular call without being 
billed. If the bogus mobile subscriber unit changes 
5 or "tumbles" the subscriber number after each call, 
the existing cellular telephone systems cannot stop 
the bogus calls unless a tumbling pattern is detected. 
This bogus mobile subscriber unit B can then initiate 
cellular calls using the bogus subscriber numbers and 

10 existing cellular mobile telephone systems are unable 
to identify that this bogus mobile subscriber unit B 
is not authorized to receive service. Tumbling of 
subscriber numbers is a significant problem in the 
cellular communication industry and it accounts for 

15 significant lost revenues due to the fact that the 
common carrier cannot be paid for the calls initiated 
by the bogus mobile subscriber unit. This theft of 
service is thwarted by the apparatus of the present 
0 invention, which detects bogus subscriber units prior 

20 to call completion. 

Architecture of Tumbling Detection Apparatus 

Figures 2 and 3 illustrate in block diagram form 
the apparatus of the present invention which is used 
to detect the presence of a mobile subscriber unit B 

2 5 ' that has been programmed with a bogus subscriber 

number and to disable such bogus mobile subscriber 
unit B from receiving communication services in this 
cellular service area. For the purpose of this 
invention, it is assumed that this tumbling detection 

3 0 apparatus is located within the roamer verification 

* 

system 101 noted above. The installation of this 
tumbling detection apparatus therein provides a 
greater areal coverage and therefore enables this 



WO 93/11646 



-10- 



PCT/US92/10198 



tumbling detection apparatus to identify and locate 
the bogus mobile subscriber unit even though it may 
roam from one service area to another. 

This tumbling detection apparatus includes a 
5 database that contains information concerning the 
identity and access telephone number of the plurality 
of mobile telephone systems located within the service 
..area covered.by this particular apparatus. The mobile 
telephone switching office 102, in response to a call 

10 origination from a roaming mobile subscriber unit A, 
transmits a roaming subscriber validation request to 
roamer verification system 101 to determine whether 
the roaming subscriber is authorized to receive 
service. The mobile telephone switching office 102 

15 does not further process this call origination until 
receiving a positive roamer validation from roamer 
verification system 101. The roamer verification 
system 101 scans its database to determine whether 
roaming subscriber unit A is a valid user, based on 

20 the subscriber number transmitted by roaming 
subscriber unit A. If the subscriber number is not in 
this database, roamer validation system 101 must 
determine whether this is a bogus subscriber unit that 
is tumbling subscriber numbers to fraudulently receive 

25 cellular service. 

The roamer verification system 101 provides the 
tumbling detection capability by using a data 
interface and data links 104, 105 to exchange 
subscriber and call related data with a plurality of 

3 0 mobile telephone switching offices 102, 103. The 
roamer verification system 101 includes a subscriber 
status database (SSDB) which is the single repository 
for roamer status information. When cellular 
telephone calls are originated by a roaming 
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subscriber, the roaming subscriber's identification is 
checked against the data stored in the subscriber 
status database to determine whether this is an 
authorized user. The determination made by the roamer 
5 verification system 101 is transmitted back to the 
mobile telephone switching office that originated the 
subscriber validation request. 

Implementation Details of Cloning Detection Apparatus 
Figures 2 and 3 illustrate a portion of the 
10 architecture of the roamer verification system 101 
that pertains to the tumbling detection capability. 
The roamer verification system 101 includes, in the 
preferred embodiment, two processor complexes 2 01, 2 02 
which provide the computing power necessary to manage 
15 the validation and billing of the number of roaming 
subscribers found in the cellular mobile telephone 
network. The VPC processor 201 typically consists of 
a VAX/VMS processor complex manufactured by Digital 
Equipment Corporation of Maynard, Massachusetts. The 
20 VPC processor 201 provides many of the existing roamer 
validation services, such as the Roaming America 
service 231 and the Positive Roamer Verification 
service 23 3 offered by Appex Corporation as well as 
operator- interface and maintenance software. The VPC 
25 processor 2 01 additionally includes intercarrier 
settlement services software 236 which records all the 
billing data for the various service entities that are 
connected to the roamer verification system 101; 

The FTS processor 2 02 consists of a Stratus SA 
30 2000 fault tolerant processor complex upon which the 
tumbling detection software is implemented. The FTS 
processor 202 includes two transaction processing 
systems: database server system (DSS) 221 and 
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verification system (VS) 222. The database server 
system 221 controls access to the subscriber status 
database 317 and other databases 312 - 316 used by the 
verification system 222. Verification system 222 
5 provides verification services to mobile telephone 
switching offices 102, 103 that are served by the 
roamer verification system 101. The interface between 

- the roamer verification system 101 and the plurality 

of Mobile Telephone Switching Offices 102, 103 is„ 
10 implemented in the XLI gateway system 2 03 which is a 
message handler that simplifies the intercommunication 
between the various connected entities. 

Verification System 

The verification system 222 provides roamer 

15 verification services for a plurality of mobile 
telephone switching offices 102, 103. The 
verification system 222 receives qualification request 
invokes from Mobile Telephone Switching Offices 102, 
103 via an X.25 packet switching network illustrated 

20 diagrammatically on Figure 1 as data links 104, 105. 

Alternatively, intercommunication can be accomplished 
using the SS7 networking protocol. In either case, 
upon receipt of a qualification request, the 
verification system 222 transmits an inquiry to 

25 database server system 221 to determine the status of 
the roaming subscribing unit B which is requesting 
service in one of the Mobile Telephone Switching 
Offices (103). The database server system 221 
determines the status of the roaming subscriber unit 

30 B by retrieving data associated with that designated 
subscriber unit B from the subscriber status database 
317. The retrieved data is then transmitted by 
database server subsystem 221 to the verification 
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system 222 wherein a de-termination is made whether the 
requesting subscriber unit B is authorized to receive 
the service it has requested. The verification system 
222 accesses routing information from its own internal 
5 memory that enables it to respond to the Mobile 
Telephone Switching Office 102 on either a per NPA-NXX 
or on a per roaming location basis. Based on the 
status contained in the subscriber status database, 
the' verif ication system 222 transmits a qualif ication 

10 request to the Mobile Telephone Switching Office 103 
in which the requesting subscriber unit B is presently 
located. The verification system 222 then determines 
whether sufficient data is contained in the subscriber 
status database 317 to make a determination of the 

15 authorization of this requesting subscriber unit B. 

If not, an information request message is transmitted 
to the home Mobile Telephone Switching Office ex 102 
assigned to the requesting subscriber unit B to obtain 
sufficient subscriber data to make an authorization 

2 0 determination. When the response to this inquiry is 
received by the verification system 222 it transmits 
an update to the database server system 221 which 
accordingly updates the subscriber status database 317 
for this requesting subscriber unit B. A complete 

25 record of all transaction activity is maintained for 
both daily and online reporting. If the data 
collected by verification system 222 indicates that 
the roaming subscriber unit B is authorized to receive 
the requested service, an authorization request 

30 message is transmitted to the Mobile Telephone 
^ Switching Office 103 in whose service area the roaming 

subscriber unit B is presently located. In response 
to the received message from the roamer verification 
system 101, the Mobile Telephone Switching Office 103 
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provides the requested call connections to subscriber 
unit B. 



Data base Server System 

The database server system 221 provides and 
5 controls access not only to the subscriber system 
database 317 but also to a denial database 313, call 
detail database 312 and a home switch database .314. 
The subscriber status database 317 is the single 
repository of roamer status information for all 
10 roaming subscriber units served by the Mobile 
Telephone Switching Offices 102, 103 connected to the 
roamer verification system 101. It thereby provides 
timely access to roamer status information. The 
database server system 221 also maintains summary 
15 statistics on subscriber status database usage for 
monitoring and reporting purposes. It also maintains 
a record of all updates made to the subscriber status 
database 317 on a daily basis. 

As illustrated in Figure 3, the database server 
20 system 221 is comprised of seven functional 
components : 

1. File access component 3 01. 

2. Subscriber summary database server 
306. 

25 3. Subscriber status database server 307. 

4 . Call detail server 
302. 

5. Denial server 303. 

6. Tumbling server 3 04. 

30 7. Daily modification database server 

3 05. 

The file access component 3 01 is the entrance and exit 
point for all messages destined for the above listed 
database 3 02 - 3 07 servers. Access to the databases 
35 312 - 317 within this system occurs directly with the 
servers 3 02 - 307 for those files. 
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File Access Controller 

The file access controller 301 is responsible for 
receiving messages from other processes within the 
roamer verification system 101 and forwarding them to 
5 the appropriate subscriber status database server. 
The file access controller 301 is also responsible for 
returning responses to the process -that originated the 
message. It is obvious that within this system there 
are a plurality of processes that are not described 

10 herein that are standard for a database of this type. 
These processes include additions to the database, 
modifications to the database, inquiries and updates. 
For the purpose of simplifying this description, only 
details concerning detection of tumbled subscriber 

15 numbers is presented. 

Call Processing 

When a roaming subscriber unit B originates a 
call in one of the cell sites 106 served by a Mobile 
Telephone Switching Office 103, this is accomplished 

2 0 in well known fashion by roaming subscriber unit B 

interacting with cell site transmitter 12 4 to 
establish a radio frequency link therebetween. Once 
the radio frequency link has been established between 
cell site transmitter 124 and roaming subscriber unit 
25 B, data messages are transmitted over data link 1124 
from cell site transmitter 124 to Mobile Telephone 
Switching Office 103, Mobile Telephone Switching 

Office 103 recognizes the request for a call 

origination^ and the fact that roaming subscriber unit 

3 0 B is not one of the subscriber units whose home base 

is Mobile Telephone Switching Office 103. Due to the 
fact that information concerning roaming subscriber 
unit B is not contained within the database internal 
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to Mobile Telephone Switching Office 103, control 
messages are thereby transmitted by this switching 
office 103 by data link 105 to roamer verification 
system 101 to obtain information concerning the 
authorization of roaming subscriber unit B to 
originate and receive cellular service. This is 
accomplished by Mobile Telephone Switching Office 103 
-transmitting a call detail notification message to the 
roamer verification system 101. This is received by 
the XL.I gateway system 203 and forwarded to the 
verification system 221 for processing therein. When 
the verification system 222 receives a roamer 
verification request, it transmits a message to the 
database server system 221 which message contains the 
following information: 

1. Mobile identification number (MIN) . 

2. Electronic Serial Number (ESN). 

3. Roam Switch Identifier. 

4. Roam Switch System Identifier. 

This same information is also transmitted to tiie call 
detail server 303 for entry into the call detail 
database 313. 

Figure 4 illustrates in flow diagram form the 
operational steps taken by this roamer verification 
system 101 to identify a: bogus call originated by a 
subscriber. At step 4 01, the cellular telephone 
system 103 detects a call origination for a particular 
cellular subscriber B. As part of the standard 
subscriber validation process, at step 4 02 a 
determination is made whether there is presently an 
the mobile subscriber unit A that originated this call 
is a roaming mobile subscriber unit. This 
determination is typically made at the cellular mobile 
telephone switching office 102 that receives the call 
origination. This cellular mobile telephone switching 
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office reviews the mobile subscriber identification 
number with a table of authorized subscribers whose 
home switch is cellular mobile telephone switching 
office 102. If there is a lack of correspondence 
5 between the mobile telephone subscriber unit 
identification number received from subscriber 
telephone unit A and the database that is stored in 
the cellular mobile telephone switching, of f ice 102, it 
is indicative that this is a roaming subscriber 

10 requesting service and call processing advances to 
step 403. If the call origination was from a mobile 
subscriber unit whose home office was mobile telephone 
switching office 102, call processing would proceed in 
a normal, fashion as is well known in the .art and not 

15 described herein. The cellular mobile telephone 
switching office 102 at step 403 notes the call 
origination status of mobile subscriber unit A and 
does not proceed with processing this service request 
until a positive roamer verification is received from 

20 roamer verification system 101. Therefore, the call 
origination from roaming subscribing unit A is placed 
on hold at step 403 in the mobile telephone switching 
office 102 and a roamer validation request message is 
transmitted to roamer verification system 101 over the 

25 data links 105 that interconnect the roamer 
verification system 101 with this particular cellular 
mobile telephone switching office 102. Upon receipt 
of a roamer validation request, roamer verification 
system 101 at step 405 scans its internal database to 

3 0 determine whether the roaming subscribing unit A is a 
valid user. This is accomplished by roamer 

verification system 101 switching the received roamer 
validation request to verification system 222 for 
processing. Verification system 222 decodes the 
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received message and initiates a priority database 
request since this operation is of a high priority 
since the call origination is being held by the mobile 
telephone switching office 102. Database service 
5 system 221 receives the priority database scan request 
from verification system 222 accesses subscriber 
status database 317 to determine whether the 
subscriber identification number transmitted to the 
roamer verification system 10T by the mobile telephone 

10 switching office 102 matches any of the authorized 
subscriber identification numbers stored in subscriber 
status database 317 at step 405. At step 406, a 
determination is made whether the roaming subscriber's 
identification number is stored in the* subscriber 

15 status database 317. If it is, the roaming subscriber 
is a valid user and authorized to receive cellular 
services as a roaming subscriber. At step 407, 
database server 222 transmits a response to 
verification system 221 indicative of a positive 

20 verification of the identity of the roaming subscriber 
who is requesting a call origination. The 
verification system 221 transmits a data message over 
data link 105 to the cellular mobile telephone 
switching office 102 serving roaming subscriber A to 

25 indicate that this subscriber is a valid user. 

Cellular mobile telephone switching office 102 in 
response to the receipt of this message releases the 
hold placed on this call origination and services this 
subscriber's request. 

30 If, at step 4 06, this roaming subscriber's 

identification number is not located in the subscriber 
status database 317, then either the subscriber is a 
new roaming subscriber unit or it's possibly a bogus 
subscriber unit which is using number tumbling as a 
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method of fraudulently obtaining services. In order 
to resolve this status ambiguity with regard to 
roaming subscriber unit A, at step 408, roamer 
validation system 101 accesses a database contained 
5 therein which lists the identity of each cellular 
mobile switching office served by roamer validation 
system 101. Associated with each identified cellular 
mobile switching office entry is data indicative of 
the type of system used to implement this switching 

10 office as well as the message format required to 
communicate therewith and access data to identify a 
communication path from roamer verification system 101 
to the identified switching office. At step 409, 
verification system 222 translates-, the subscriber 

15 identification number to a cellular mobile switching 
office identification which is then used to access the 
data record stored in this database associated with 
the identified cellular mobile switching office. At 
step 410, the retrieved data record is used to 

2 0 formulate a roamer validation request message in the 

format required by the home switching office of the 
roaming subscriber. At step 411, a data connection is 
originated by verification system 222 over data link 
105 to the identified home switching office using the 
25 data connection information retrieved from the 
database. Once the data connection is established 
with the home switching office, the formatted roamer 
validation request message is transmitted to this home 
..switching office in order to determine whether this 

3 0 subscriber unit is a valid subscriber. The home 

switching office upon receipt of the roamer validation 
request from the roamer verification system 101 scans 
its subscriber database to determine whether this 
subscriber identification number is a valid user 
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number or a bogus number. At step 412, the response 
is received from the home switching office at roamer 
verification system 101 and decoded in order to 
determine whether the home switch has identified this 
5 roaming subscriber unit as a valid subscriber. At 
step 413 the determination is made whether this 
roaming subscriber unit is valid or bogus. If a 
positive determination is made that the roaming 
subscriber unit is a" valid subsciribier, the irbamer 
10 verification system 101 at step 415 transmits a data 
message to the serving mobile switch 102 to indicate 
that it is authorized to provide the requested service 
to the roaming subscribing unit A. If however a 
positive subscriber identity verification has not been 
15 received from the home switch nor obtained from the 
roamer verification system 101 database, a message is 
transmitted by the roamer verification system 101 at 
step 414 to the serving mobile telephone switching 
office indicative of the lack of a positive roamer D 
20 verification at which point the cellular mobile 
switching office 102 denies service to this roaming 
subscriber unit and presumes that this a bogus unit 
attempting to fraudulently obtain service. The 
serving cellular mobile telephone switching office 102 
25 therefore denies service to this bogus unit. 

By performing the subscriber identification 
number validation on every call origination prior to 
providing the requested service, tumbling fraud can be 
eliminated since every bogus number will be identified 
3 0 prior to providing the subscriber unit with any 

service. The speed of operation of the roamer n 
verification system 101 is enhanced by the use of the 
home switching office look up table which allows the 
rapid creation, formatting and transmission of data 
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messages between the roamer verification system 101 
and the home switching office for each subscriber unit 
that is not already catalogued in the database 
contained within the roamer verification system 101. 
5 The operation of the roamer verification system 101 is 
maintained at a high level of responsiveness since the 
data comparison that must be performed is a matching 
of the MIN/ESN to entries in the database. The simple 
existence of" a" matching subscriber " identification 

10 number is all that is required to positively identify 
the mobile subscriber unit as a valid unit. This 
simple mapping of the input subscriber identification 
number to table entries without requiring the access 
to the data record associated" with these entries 

15 enables the roamer verification system 101 to process 
a significant number of requests in real time without 
delaying the provision of service to the subscriber 
units. 

While a specific embodiment of this invention has 
2 0 been disclosed, it is expected that those skilled in 
the art can and will design alternate embodiments of 
this invention that fall within the scope of the 
appended claims. 
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1. In a cellular mobile telephone system, 
wherein a plurality of mobile telephone switching 
offices (102, 103) , each of which serves a plurality 
of cell sites (12*, 13*) for establishing cellular 
5 call connections with mobile subscriber units (A, B) 
located in a geographical area covered by said cell 
sites (12*, 13*), are connected • to a ' subscriber 
verification system (101) which validates the 
authorization of subscriber units (A, B) , each of 
10 which is identified by a unique subscriber 
identification code assigned to said subscriber unit 
(A) , to receive service when : roaming outside of the 
subscriber's home mobile telephone switching office 
(103) , apparatus in said subscriber verification 
15 system (101) to detect subscriber identification code 
tumbling comprising: 

database means (317) for storing data 
indicative of subscriber unit identification codes of 
mobile subscriber units (A) authorized to receive 
20 service in a mobile telephone switching office (103) ; 

means (317, 401-405), responsive to a 
roaming subscriber unit (A) originating a cellular 
call connection in one of said mobile telephone 
switching offices (102) , for storing a subscriber unit 
25 identification code assigned to said roaming 
subscriber unit (A) ; 

means (406) for determining a correspondence 
between said subscriber unit identification code of 
said roaming subscriber and said stored data ; 
30 means (233, 408-411), responsive to a lack 

of correspondence between said subscriber unit 
identification code of said roaming subscriber and 
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said stored data, for transmitting a roamer validation 
request message to said roaming subscriber 1 s home 

35 mobile telephone switching office (103) ; and 

means (412-413, 415), responsive to a 
receipt of a message from said roaming subscriber's 
home mobile telephone switching office (103) 
validating the identity of said roaming subscriber, 

40 for authorizing the provision . of service to said 
roaming subscriber. 

2. The apparatus of claim 1 wherein said 
authorizing means (412-413, 415) includes: 

means (415) for transmitting a message to 
said one mobile telephone switching office (102) to 
5 identify said roaming subscriber as a valid 
subscriber. 

3. The apparatus of claim 2 further comprising: 
means (4 03, 414) for blocking the provision 

of service to said roaming subscriber absent said 
message identifying said roaming subscriber as a valid 
5 subscriber . 

4. The apparatus of claim 1 further comprising: 
means (401-404), responsive to a roaming 

subscriber unit (A) originating a cellular call 
connection in one of said mobile telephone switching 
5 offices (102), for transmitting said subscriber unit 
identification code assigned to said roaming 
subscriber unit (A) to said storing means (317, 401- 
405) . 

5. The apparatus of claim 1 further comprising: 
means (410) for listing a correspondence 
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between each of said plurality of mobile telephone 
switching offices (102, 103) and a roaroer validation 
5 request message format- , 

6. The apparatus of claim 5 wherein said K% 
transmitting means (233 , 408-411) includes: 

means (408, 409) for identifying said 
roaming subscriber's home mobile telephone switching 
5 office (103) from said subscriber unit identification 
code assigned to said roaming subscriber unit (A) - 

7. The apparatus of claim 6 wherein said 
transmitting means (233, 408-411) further includes: 

means (409), ' responsive to the 
identification of said roaming subscriber's home 
5 mobile telephone switching office (103), for 
retrieving said roamer validation request message 
format corresponding to said identified home mobile 
telephone switching office (103) from said listing o 
means (410) . 

8. The apparatus of claim 7 wherein said 
transmitting means (233, 408-411) further includes: 

means (410) for populating said retrieved 
message format with said roaming subscriber unit 
5 identification code; and 

means (411) for establishing a data 
connection to said identified home mobile telephone 
switching office (103) to transmit said populated 
message format. 

P 

9. The apparatus of claim 1 further comprising: 

means (412-414) , responsive to a receipt of f 
a message from said roaming subscriber's home mobile 



WO 93/11646 



-25- 



PCT/US92/10198 



telephone switching office (103) failing to validate 
5 the identity of said roaming subscriber, for denying 
the provision of service to said roaming subscriber. 

10. The apparatus of claim 9 wherein said 
authorizing means (412-413, 415) includes: 

means (414) for transmitting a message to 
said one mobile- telephone switching office (102) to 
5 identify said roaming subscriber as a bogus 
subscriber. 

11. In a cellular mobile telephone system, 
wherein a plurality of mobile telephone switching 
offices (102, 103), each of which serves a plurality 
of cell sites (12*, 13*) for establishing cellular 

5 call connections with mobile subscriber units (A, B) 
located in a geographical area covered by said cell 
sites (12*, 13*), are connected to a subscriber 
verification system (101) which 0 validates the 
authorization of subscriber units (A, B) , each of 

10 which is identified by a unique subscriber 
identification code assigned to said subscriber unit 
(A) , to receive service when roaming outside of the 
subscriber's home mobile telephone switching office 
(103) , a method in said subscriber verification system 

15 (101) to detect subscriber identification code 
tumbling comprising the steps of: 

storing data indicative of subscriber unit 
identification codes of mobile subscriber units (A) 
authorized to receive service in a mobile telephone 

20 switching office (103) ; 

storing, in response to a roaming subscriber 
unit (A) originating a cellular call connection in one 
of said mobile telephone switching offices (102), in 



-26- 



a memory (317) a subscriber unit identification code 
assigned to said roaming subscriber unit (A) ; 

determining a correspondence between said 
subscriber unit identification code of said roaming 
subscriber and said stored data; 

transmitting , in response to a lack of 
correspondence between said subscriber unit 
identification code of . said roaming subscriber and 
said stored data, a roamer validation request message 
to said roaming subscribers home mobile telephone 
switching office (103) ; and 

authorizing, in response to a receipt of a 
message from said roaming subscriber's home mobile 
telephone switching * office (103) validating the 
identity of said roaming subscriber, the provision of 
service to said roaming subscriber. 

12. The method of claim 11 wherein said step of 
authorizing includes: 

transmitting a message to said one mobile 
telephone switching office (102) to identify said 
roaming subscriber as a valid subscriber. 

13. The method of claim 12 further comprising 
the step of: 

blocking the provision of service to said 
roaming subscriber absent said message identifying 
said roaming subscriber as a valid subscriber. 

14. The method of claim 11 further comprising 
the step of: 

transmitting, in response to a roaming 
subscriber unit (A) originating a cellular call 
connection in one of said mobile telephone switching 
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offices (102) , said subscriber unit identification 
code assigned to said roaming subscriber unit (A) to 
said memory (317) - 

15. The method of claim 11 further comprising 
the step of: 

listing in said memory (317) a 
correspondence between each of said plurality of 
5 mobile telephone switching offices (102, 103) and a 
roamer validation request message format. 

16. The method of claim 15 wherein said step of 
transmitting includes: 

identifying- said roaming subscriber's home 
mobile telephone switching office (103) from said 
5 subscriber unit identification code assigned to said 
roaming subscriber unit (A) . 

17. The method of claim 16 wherein said step of 
transmitting further includes: 

retrieving, in response to the 
identification of said roaming subscriber's home 
5 mobile telephone switching office (103) , said roamer 
validation request message format corresponding to 
said identified home mobile telephone switching office 
(103), from said memory (317). 

18. The method of claim 17 wherein said step of 
transmitting further includes: 

populating said retrieved message format 
with said roaming subscriber unit identification code ; 
and 

establishing a data connection to said 
identified home mobile telephone switching office 
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(103) to transmit said populated message format. 

19. The method of claim 11 further comprising 
the step of: 

denying, in response to a receipt of a 
message from said roaming subscriber's home mobile 
5 telephone switching office (103) failing to validate 
the identity of said roaming subscriber, the provision 
of service to said roaming subscriber. 

20. The method of claim 19 wherein said step of 
authoriz ing includes : 

transmitting a message to said one mobile 
telephone switching office (102) to identify said 
5 roaming subscriber as a bogus subscriber. 
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